ffi: sanity check on object in ffi_val_get.

* ffi.c (ffi_val_get): Throw an exception if the object
doesn't appear valid.

* gc.c (valid_object_p): New function.  Invalid objects are
those that are pointers, but either not into a heap, or else
to a freed object or to an object that is marked by the
garbage collector (should only be seen while GC is running).
All others are valid.  There can be false positives here: a
value with the LIT tag is in fact a pointer, but we don't
check whether that is valid.

* gc.c (valid_object_p): Declared.

* txr.1: Remarks added to documentation of FFI val type.

1 files changed, 6 insertions, 0 deletions

diff --git a/txr.1 b/txr.1
index ef497f22..a3277998 100644
--- a/txr.1
+++ b/txr.1
@@ -53414,6 +53414,12 @@ values that aren't objects which came from a Lisp heap.
 Interpreting a Lisp value in foreign code requires a correct decoding of
 its type tag, and, if necessary, stripping the tag bits to recover a heap
 pointer and interpreting the type code stored in the heap object.
+
+The conversion from foreign bit pattern to Lisp value is subject to a
+validity checks; an exception will be thrown if the bit pattern isn't a valid
+Lisp object. Nevertheless, the checks has cases which report as false
+positives: admit some invalid objects may be admitted into the Lisp realm,
+possibly with catastrophic results.
 .ccIP @ cptr
 This type corresponds to a C pointer of any type, including a function pointer;
 \*(TX doesn't run on any exotic platforms in which there is a representational